OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
97f4ed3b71
qemu-e2k/hw
History
Prasad J Pandit 97f4ed3b71 sd: limit 'req.cmd' while using as an array index 
While processing standard SD commands, the 'req.cmd' value could
lead to OOB read when used as an index into 'sd_cmd_type' or
'sd_cmd_class' arrays. Limit 'req.cmd' value to avoid such an
access.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1453315857-1352-1-git-send-email-ppandit@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-02-11 11:17:32 +00:00
..
9pfs virtio: move allocation to virtqueue_pop/vring_pop 2016-02-06 20:39:07 +02:00
acpi qom: Swap 'name' next to visitor in ObjectPropertyAccessor 2016-02-08 17:29:56 +01:00
alpha
arm Use error_fatal to simplify obvious fatal errors (again) 2016-02-08 17:22:00 +01:00
audio sb16: use IsaDma interface instead of global DMA_* functions 2016-02-03 11:28:58 -05:00
block pc and misc cleanups and fixes, virtio optimizations 2016-02-08 11:25:31 +00:00
bt hw: Clean up includes 2016-01-29 15:07:25 +00:00
char virtio: introduce qemu_get/put_virtqueue_element 2016-02-06 20:44:08 +02:00
core qapi: Drop unused 'kind' for struct/enum visit 2016-02-08 17:29:57 +01:00
cpu hw: Clean up includes 2016-01-29 15:07:25 +00:00
cris cris: Clean up includes 2016-01-29 15:07:24 +00:00
display virtio: move allocation to virtqueue_pop/vring_pop 2016-02-06 20:39:07 +02:00
dma dma: remove now useless DMA_* functions 2016-02-03 11:28:58 -05:00
gpio hw: Clean up includes 2016-01-29 15:07:25 +00:00
i2c hw: Clean up includes 2016-01-29 15:07:25 +00:00
i386 qom: Swap 'name' next to visitor in ObjectPropertyAccessor 2016-02-08 17:29:56 +01:00
ide qom: Swap 'name' next to visitor in ObjectPropertyAccessor 2016-02-08 17:29:56 +01:00
input virtio: move allocation to virtqueue_pop/vring_pop 2016-02-06 20:39:07 +02:00
intc qom: Swap 'name' next to visitor in ObjectPropertyAccessor 2016-02-08 17:29:56 +01:00
ipack hw: Clean up includes 2016-01-29 15:07:25 +00:00
ipmi ipmi_bmc_sim: Add break to correct watchdog NMI check 2016-02-09 15:46:54 +01:00
isa qom: Swap 'name' next to visitor in ObjectPropertyAccessor 2016-02-08 17:29:56 +01:00
lm32
m68k m68k: Clean up includes 2016-01-29 15:07:24 +00:00
mem qom: Swap 'name' next to visitor in ObjectPropertyAccessor 2016-02-08 17:29:56 +01:00
microblaze
mips magnum: disable floppy DMA for now 2016-02-03 11:28:57 -05:00
misc qom: Swap 'name' next to visitor in ObjectPropertyAccessor 2016-02-08 17:29:56 +01:00
moxie moxie: Clean up includes 2016-01-29 15:07:25 +00:00
net qom: Swap 'name' next to visitor in ObjectPropertyAccessor 2016-02-08 17:29:56 +01:00
nvram hw: Clean up includes 2016-01-29 15:07:25 +00:00
openrisc openrisc: Clean up includes 2016-01-29 15:07:24 +00:00
pci fix MSI injection on Xen 2016-02-06 20:44:10 +02:00
pci-bridge hw/pxb: add pxb devices to the bridge category 2016-02-06 20:44:08 +02:00
pci-host qom: Swap 'name' next to visitor in ObjectPropertyAccessor 2016-02-08 17:29:56 +01:00
pcmcia hw: Clean up includes 2016-01-29 15:07:25 +00:00
ppc qapi: Drop unused error argument for list and implicit struct 2016-02-08 17:29:57 +01:00
s390x
scsi hw: Add support for LSI SAS1068 (mptsas) device 2016-02-09 15:45:26 +01:00
sd sd: limit 'req.cmd' while using as an array index 2016-02-11 11:17:32 +00:00
sh4 sh4: Clean up includes 2016-01-29 15:07:24 +00:00
smbios hw: Clean up includes 2016-01-29 15:07:25 +00:00
sparc dma: remove now useless DMA_* functions 2016-02-03 11:28:58 -05:00
sparc64 dma: remove now useless DMA_* functions 2016-02-03 11:28:58 -05:00
ssi hw: Clean up includes 2016-01-29 15:07:25 +00:00
timer log: do not unnecessarily include qom/cpu.h 2016-02-03 09:19:10 +00:00
tpm hw: Clean up includes 2016-01-29 15:07:25 +00:00
tricore tricore: Clean up includes 2016-01-29 15:07:25 +00:00
unicore32
usb qom: Swap 'name' next to visitor in ObjectPropertyAccessor 2016-02-08 17:29:56 +01:00
vfio hw/vfio: Clean up includes 2016-01-29 15:07:24 +00:00
virtio qapi: Drop unused 'kind' for struct/enum visit 2016-02-08 17:29:57 +01:00
watchdog hw: Clean up includes 2016-01-29 15:07:25 +00:00
xen fix MSI injection on Xen 2016-02-06 20:44:10 +02:00
xenpv xen: Clean up includes 2016-01-29 15:07:23 +00:00
xtensa xtensa: Clean up includes 2016-01-29 15:07:24 +00:00
Makefile.objs